30bf02fe40e1d5ddef5bff6000fbf680172d6977dde11c03ae50ce36742a6c98

Analysis

user interaction
yes
max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
05/09/2026, 08:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Keyser Cracked.exe
Size 3.0MB
Sample260905-knw2ba1aqa
SHA256 30bf02fe40e1d5ddef5bff6000fbf680172d6977dde11c03ae50ce36742a6c98
MD5 ffe1721e90dd4bd26f3e43a1249087db
SHA1 6a301521e7110540dc8a10c1abdd7e37daa871fa
SHA512 03630a0947a2287df03e255253a16ba815bf838b3ee8fa4ed828d511159777c1bb7717d77075e1fb5b9e633299c764f1e8f5326610659c390cda154291cd554e
SSDEEP 49152:nIUIsPAmEnzgA++NVlH0kpa8/Cg82NV9q3d+anVqamiaSJbRVJUpqAotxa:nIAIRnz7++NVtl/CghNV9NNxaRekx
TLSH
T1FEE533538A3089C5F7D5B7FA00F3C117930E7A2943AA05C76A255EF422BB7E4B273156
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3972	Keyser_Crack.exe
4672	Launcher.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
3972	Keyser_Crack.exe
3972	Keyser_Crack.exe
3972	Keyser_Crack.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Launcher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Launcher.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3972	Keyser_Crack.exe
3972	Keyser_Crack.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3972	Keyser_Crack.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3196 wrote to memory of 3972	3196	Keyser Cracked.exe	80
PID 3196 wrote to memory of 4672	3196	Keyser Cracked.exe	81

C:\Users\Admin\AppData\Local\Temp\Keyser Cracked.exe
"C:\Users\Admin\AppData\Local\Temp\Keyser Cracked.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3196
- C:\Users\Admin\AppData\Local\Temp\F468FD7B\Keyser_Crack.exe
  "C:\Users\Admin\AppData\Local\Temp\F468FD7B\Keyser_Crack.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  PID:3972
- C:\Users\Admin\AppData\Local\Temp\F468FD7B\Launcher.exe
  "C:\Users\Admin\AppData\Local\Temp\F468FD7B\Launcher.exe"
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  PID:4672

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Keyser_Crack.exe

Path C:\Users\Admin\AppData\Local\Temp\F468FD7B\Keyser_Crack.exe
Size 5.5MB
SHA256 0807ebabb52b9e4142ae8d69092d572f53455640142c5a12331b3f84f439f01a
MD5 7f46f461617bcca1330d0b9aa8670cb8
SHA1 ab440e4c4104fac33b0a1d311c47c5bfc40e4468
SHA512 db7bcf2d4b31dafc45e38925052bd912117d085d0c8bb68b9ef68f55a73c1d0b033900bbe1a64de176284de5d0559a76264ceb8bc46244c8de14d14d5e464575
SSDEEP 49152:ZzWqXTy4CP9JjU291m8Njg0XuM1LNDJr6M+xh7mbWUtqTYQ3oP9cj8lMyQ19y:Zx/MI0XRFJuMWIk3oP9Pw1
TLSH
T1CF46C016B3A652ACC02B983CDA63E227E37274102B3997DF73C406659F577F00A7A746
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Launcher.exe

Path C:\Users\Admin\AppData\Local\Temp\F468FD7B\Launcher.exe
Size 1.1MB
SHA256 52e97087c2a076a1c05a689a8d5e8e87374140a05d139ea2295e8164d12652f8
MD5 529e077e9fd89750dbce84efd6c2dbfc
SHA1 ecc69ded85ff2e38f872c9dc4f32c602e0611be6
SHA512 6f21a38e1227652c551e2716e6566c678e5bfb6775326715328cb9e8c97a4020a6a7f87f1af7f70cf630b22eef67c7040e0d84a5b94fe89360dac4e06738fe87
SSDEEP 12288:qbs/m0E54jwaFXGc8lEBBBHGBKq2IZwDLvfqItNqdg:qbOVE5ifGPRZwHvf3fd
TLSH
T11B357C83E7A385D8C116D9B5434BF137F9627C8E4B157197ABC41E633A67BA4E22CB00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download